Key insights - Google Analytics cookie consent script

A Google Analytics cookie consent script that loads after GA4 has already fired is not consent at all, because the identifiers were stored and the data sent before anybody clicked anything.

In the EU and UK, that usually means Google Analytics should not load until the visitor gives valid consent for analytics storage, unless a narrow national exemption applies and the implementation qualifies. Most standard GA4 implementations do not.

Consent Must Come Before Tracking

A common mistake is showing a banner while Google Analytics has already fired. That is not consent. The page has already stored or accessed identifiers and sent data.

The correct sequence is:

1. Page loads with non-essential analytics disabled.
2. Banner or preference UI appears.
3. Visitor accepts analytics.
4. GA4 loads or receives updated consent signals.
5. Analytics cookies and events begin only after consent.

If the visitor rejects analytics, GA4 should not set analytics cookies. If you use Google Consent Mode, configure defaults as denied before any Google tag runs.

Understand Consent Mode

Google documents consent types such as analytics_storage, which controls storage related to analytics, and advertising-related signals such as ad_storage, ad_user_data, and ad_personalization.

Consent Mode can help tags adapt to consent choices, but it is not a substitute for a lawful consent interface. It also does not make every data flow anonymous or consent-free. Your CMP, tag configuration, regional settings, and vendor disclosures still matter.

Implementation Mistakes to Avoid

Loading GTM before consent without controls. Google Tag Manager can be configured carefully, but it can also load many third-party tags before consent if triggers are wrong.

Treating "continue browsing" as consent. EDPB consent guidance requires a clear affirmative act. Passive browsing is not enough.

Making reject harder than accept. Dark patterns can invalidate consent and create enforcement risk.

Forgetting linked products. GA4 linked to Google Ads, Google signals, or remarketing features creates a different privacy profile than basic measurement.

Sending personal data in events. Never send emails, names, phone numbers, account IDs, or form text to GA4.

Ignoring withdrawal. Users must be able to change choices, and tracking should stop after withdrawal.

Why Consent Creates Data Gaps

If consent is required and some users decline, your analytics will be incomplete. That is not a bug. It is the legal and ethical consequence of asking.

Expect gaps by:

• region
• browser
• device type
• traffic source
• audience privacy preference
• ad blocker usage

Do not "fix" the gap by firing tags before consent. Instead, interpret reports as consented-user analytics and use privacy-first aggregate tools when you need a fuller view of basic traffic.

A Safer GA4 Setup

If you keep GA4, configure it conservatively:

• default consent to denied in applicable regions
• disable Google signals where not needed
• disable granular location and device collection where appropriate
• avoid remarketing audiences unless consent explicitly covers them
• sanitize URLs and event parameters
• set retention deliberately
• document vendor terms and transfer mechanism
• test cookies before and after consent

Google says GA4 does not log or store IP addresses and offers EU-focused data controls, including EU collection routing and regional settings. Those controls are useful, but they do not remove cookie consent obligations where ePrivacy rules apply.

When to Use Cookieless Analytics Instead

For many teams, GA4 is more complex than the question they need answered. If you mainly need pageviews, referrers, campaigns, top pages, and conversions, a cookieless privacy-first analytics tool is simpler.

Look for:

• no cookies by default
• no cross-site tracking
• no ad network data sharing
• aggregate reports
• query-string sanitization
• short retention controls
• transparent data processing

This can reduce the need for analytics consent banners in some jurisdictions and reduce dependence on opt-in data, while still respecting visitors. The key is the actual configuration, not the cookieless label.

The Bottom Line

Google Analytics can be configured more carefully than many default installations, but it remains a consent-heavy tool in much of Europe. If you use it, load it only after valid consent and keep payloads minimal.

If you do not need user-level tracking or ad integration, choose analytics that was designed not to need them.

Consent QA Checklist

Record whether enhanced measurement, Google Signals, ads personalization, User-ID, BigQuery export, Consent Mode, cross-domain measurement, and region-specific settings are enabled. Then test consent like a feature, not a banner design. In a clean browser, load the site and reject analytics. Confirm no GA4, Google tag, GTM analytics tag, advertising pixel, or related storage fires before or after rejection. Accept analytics and confirm only the expected tags load. Change the choice and confirm the site updates state without requiring users to clear cookies. The EDPB's cookie banner taskforce report is useful because many failures are interface and implementation failures, not only legal wording failures.

Then test edge cases: landing on a deep link, navigating between pages, using embedded forms, submitting a conversion, switching language, and returning after consent expiry. Keep screenshots, network logs, CMP settings, and tag configurations as evidence. If GA4 is configured through GTM, test both the consent platform and the container. If your site needs only aggregate audience measurement, compare the operational cost of this QA process with a cookieless analytics setup that avoids consent-heavy identifiers in the first place.